Description
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation and System Takeover
Action: Immediate Patch
AI Analysis

Impact

Vulnerability is a CWE‑284 Improper Access Control flaw in the Installation component of Oracle Siebel CRM Deployment. It allows an authenticated low‑privileged user who has logged onto the hosting infrastructure to take over the deployment. Successful exploitation results in complete loss of confidentiality, integrity, and availability of the Siebel CRM deployment application.

Affected Systems

Oracle Siebel CRM Deployment product, versions 17.0 through 26.7, is affected. All builds within this range contain the flaw in the Installation component.

Risk and Exploitability

The CVSS v3.1 base score of 7.8 classifies it as high severity. EPSS is less than 1%, indicating a very low probability of exploitation in the current threat landscape. The vulnerability is not listed in CISA KEV. The exploit requires low‑privilege local access to the server where Siebel CRM Deployment is installed; no external network vector is documented, so the attack is considered local.

Generated by OpenCVE AI on September 20, 2026 at 11:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses the Siebel CRM Deployment vulnerability for affected versions 17.0-26.7.
  • Enforce strict local user privilege policies to limit low-privileged accounts that can log onto the deployment infrastructure.
  • Monitor installation component logs for abnormal activity and conduct routine security audits on Siebel CRM Deployment access controls.

Generated by OpenCVE AI on September 20, 2026 at 11:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle siebel Crm
CPEs cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*
Vendors & Products Oracle siebel Crm

Sun, 20 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege Access Allows Compromise of Siebel CRM Deployment

Thu, 17 Sep 2026 05:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege Access Allows Compromise of Siebel CRM Deployment

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Crm Deployment
CPEs cpe:2.3:a:oracle:siebel_crm_deployment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Crm Deployment
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Siebel Crm Siebel Crm Deployment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:28:53.503Z

Reserved: 2026-08-31T15:40:57.328Z

Link: CVE-2026-82992

cve-icon Vulnrichment

Updated: 2026-09-16T14:54:29.830Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:18:05.677

Modified: 2026-09-22T19:11:05.773

Link: CVE-2026-82992

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T11:30:17Z

Weaknesses